An adversarial pass over the tests and an undirected pass over the whole
diff found no Critical and fifteen Suggestions; thirteen are fixed here
and two are declined in the PR thread.

The headline is that the cross-process stress never exercised half of its
own matrix: instrumenting it shows admission won 0 of 200 rounds, because
the release goes straight to the session row lock while admission first
takes the placement-domain lock and does two reads. Half the rounds now
hold the release until the admission has committed, and the test asserts
both directions occurred, so dropping the FOR UPDATE that the whole fix
rests on turns it red with two contradictions instead of passing.

Three more assertions were satisfiable without the code they name:

- The settled-cache replay branch could be deleted without failing its
  test, because the version comparison picked the same record; the stale
  snapshot is now pinned to the settled record's own version.
- The "serve the fresher of two UNKNOWN records" rule was only covered
  with the cache holding the newer record, so collapsing that comparison
  survived the whole suite; a cancel now lands after the cached lookup
  too.
- Deleting the renewal pool's shutdown in close() was invisible, since a
  tick cancels itself while a pool's threads exit only on shutdown; a new
  test tracks the thread IDs an in-flight dispatch starts and asserts
  they are gone after close.

The v3 poll cap moves off the wall clock: the delay computation is
extracted and asserted exactly for attempts 0-7, which tells a 2s cap
from a 2.5s one in 0.2s and drops a 900ms scheduler-jitter budget from
the timing test.

Three tests that cannot fail on Windows now say so, since destroy()
terminates outright there and --ignore-term cannot wedge a worker. The
exit-hook test no longer inherits its observation window from a sleep
inside the forked harness, and the provision-race test's javadoc claims
only the guard it can reach: spawn-and-register atomicity is structural,
inside the lifecycle lock, not observable from outside it. A refused
release is now retried to prove it left the path usable, and the embedded
broker's window validation covers its null and millisecond arms.

Documentation that described behaviour the code does not have: the
deployment README called v3-result-window a result-retention period when
it is the post-dispatch polling deadline whose expiry marks the execution
UNKNOWN; the new repository primitive's contract omitted the
runtime_session_not_ready outcome both implementations throw; the window
floor's two comments justified 1s by a poll schedule that would support
100ms; the HTTP layer claimed a mutation response describes post-mutation
truth, which the pre-existing in-flight lookup merge does not guarantee;
and the design doc's problem section counted three defects while its
decisions listed five.

Declined: a longer lease for the pass-budget test (its drain measures 2.2s
against a 40s deadline, not the 12s the suggestion inferred from a
comment), and rescheduling the one-shot cooldown eviction (a backwards
clock jump retains one small record per affected execution, on the
automatic-observe path only; rescheduling becomes a perpetual timer per
entry under the injected clocks those tests use).

Suites green on top: runtime-broker 630 tests / 0 failures / 2 skipped
with checkstyle and spotbugs clean, managed-agent-server fix-adjacent
19/19 against the reinstalled jar.